Anyone who has flown on a commercial airliner knows well of the pre- flight safety briefings. From the water floatation safety cushions to the oxygen masks, it's the cabin crew's duty to ensure that every passenger is briefed. Why is this safety briefing so vital? Because when a passenger is gasping for air at 39,000 feet, it is unlikely that they will get a response when they press the flight attendant call button.
In many ways, computer incident response is akin to airplane safety; you need to know
what to expect when the inevitable occurs. If an organization attempts to manage things
ex post facto -- whether it is a depressurization at cruise level or a hack attack - their response will invariably fail. As such, the need for IT-based incident response strategy is
crucial.
Why is incident response a necessity? According to data from the Computer Security
Institute (and backed-up by many other security surveys), more than 70% of businesses
reported security breaches in the year 2000. While 70% may have answered the survey
affirmatively, the reality is that every business on the planet has security breaches. It's
simply a matter of how effectively they handle the incident. System and network hacks
are to be expected; how well they are handled, and how the damage is mitigated is up to
the organizations and their respective incident response teams.
Although I used the airline example, the authors of Incident Response compare it to fire
fighting. Incident response is akin to firefighting in that it involves the coordination of
various disciplines, namely: prevention, planning, detection, analysis, containment,
investigation, eradication, and post-incident analysis.
The difference between a fire and incident response is that whereas a fire can be
extinguished with perhaps one or two of the controls just mentioned, effective incident
response requires that all eight of the controls be effectively carried out. Another
difference between firefighting and incident response is that humanity has thousands of
years of experience in putting out fires. Computer security, however, has only been
around for a few decades. From an incident response perspective, the CERT/CC
(Computer Emergency Response Team Coordination Center) is only 13 years old. The
fact that Smokey the Bear is older than information security and incident response should
be humbling to those in technology.
The problem within many elements of corporate information technology is that they don't
understand the intricacies involved with incident response. With that, Incident Response
provides a non-technical introduction to the rudiments of setting up an incident response
team. Many technology managers don't know the difference between Certs candy and
the CERT organization. For those managers, this book will be a good start toward
teaching them how to deal with the inevitable.
Overall, Incident Response is a thorough introduction to incident response. The authors
go into detail about defining what an incident is and analyzing its various components to
show how a multi-disciplinary approach is required to rectify the situation. Those of us
in technology easily understand the need for incident response; unfortunately, many IT
managers think that incident response can be handled in a much more informal and
unofficial way. Such an erroneous management attitude will only lead to many
undetected security incidents.
Although Forno and Van Wyk give a good overview of incident response, the topic is far
too broad to be thoroughly covered in this monograph alone. For those who need a deeper
and more technical look at incident response and its associated field of computer
forensics, the following books will likely be beneficial:
· Incident Response: A Strategic Guide to Handling System and Network Security
Breaches by Russell Shumway & Gene Schultz, New Riders Publishing 2002;
ISBN: 1578702569 2002
· Incident Response: Investigating Computer Crime by Chris Prosise & Kevin
Mandia, McGraw-Hill Professional Publishing 2001; ISBN: 0072131829
· Computer Forensics -- Incident Response Essentials by Warren Kruse & Jay
Heiser, Addison-Wesley 2001, ISBN: 0201707195.
